IFIL 


From: 

Sent: 

To: 

Cc: 

Subject: 

Follow Up Flag: 
Flag Status: 


[ 


CLASS IFIEO BY HSICG/03li5™i 
EEASOBz (c> 

DECIASSIIY ON: 12-31-2033 

INlOimTIOir COMfJlIWlD 
mmiM IS OTCiAssiFiin ijrapf 
_I#EHE SeGWr OTHEEMISl 


Thursday, December 11, 2014 5:49 PM 

J(FBI) 


3 (FBI) 


Caseld: 


O I D T raining reque] 

Follow up 
Flagged 

NON-RECORD 


bt— sECRyiyyNOPORhr 


Classification: SECRET/ /NOFORiy 



JFBI) 


](FB!) 


Thanks for taking mv call this afterno on. A s dlsr u.s.<:erl. □ recently met with the U.S. Attorney in the District of 

The U.S. Attorney and FB I | [ continue to prioritize their efforts on many high profile l 

1 One o f his talking points included how successful OTD's efforts have been in the 
Iwas greativ encouraged by the U.S. Attorney today to seek the assistance of 
In supporting Is ongoing CT investigations. I 


area o 


youti 




intormation onl 


simply would like to gain 
the 


the best edge in overcoming this disadvantage and receive the latest 
legal process, and the best practices going forward with their CT cases. 


It Is with the email I am requesting that OTD se 
collection techniques to include policy/procedu 
the legal process portion of the training. 


The point of contact |~ [ for the request is[ 


r|id support tc | | ln the form of training and guidance with latest in 

es on legal process. I would likely solicitj |to assist with 


for additional questions. Looking forward to our future collaboration on this. 


Respectfully; 


] Please feel free to reach oul j ~| myself 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


bl 

b3 


b7E 


b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


1 



ALL mwammiTim roffAimp^ 
mmm is xmcmsBiwim 

BATl D5-22-201S B¥ ISfSICO/r33M57K81 


ooVoo and Kik 

ooVoo - Foreign-owned, US-based servers, unencrypted 

-passive collection from phone data channel collects 
audio and IM 

upstream collection possible but untested 

Kik Messenger - Canadian company, encrypted 
intractable encryption 
app identification only 







UNCLASSIFIED//f=©OCr 





Classification: UNCLASSIFIED/; 


-IZZI 



What are the makes/models of the devices? 


b6 

b7C 

b7E 



can provide further 


guidance (CCd). 


Thanks, 


b6 

b7C 

b7E 





UNCLASSIFIED//feya 





UNCLASSIFIED//fey© 


I 1 Can either of your respective units assist with guiding them on handling/searching the 

evidence as safely as possible, or if not, refer me to the appropriate place who might? 


Many thanks in advance. 


I b6 

Classification: UNCLASSIFIED/ /FOU e 


Classification: UNCLASSIFIED//F0t#9- 


UNCUSSIFIED//E©We- 








Fr< 

Sent: 
To: 

Cc: 

Subject: 


^ D(fbi) 

onday, December 017201 4 2:59 PM 

l(FBI)| 

RE: Kik App — UNCLASSIFIED//P©S^ 


Classification: UNCLASSIFIED/Z-i^etJe 


Please let me kn ow when you would like to dis cuss this case. We have historically been 
I Apps are consistently updated! 


A couple of suggestions and questions; 







b7E 


The best strategy will likely hp toF 


What are the makes/models of the devices? 


Jean provide further guidance (CC'd). 


b6 

b7C 


Thanks, 


b6 

b7C 

b7E 


From 
Sent: 
ToiF 
Cc:[” 


)fbi) 


Wednesday. November 26. 2 014 5:14 PM 

1 (fbdF 


(FBI)f 


Subject: Kik App — UNCLASSIFIED/TFSTO 


](FBI) 


](FBI) 


b6 

b7C 


Classification: UNCLASS I FI ED/ /• POUQ 


Gentlemen, 


Squad, out of thel 


in their possession pursuant to a search. They are awaref 


Division is in t he middle of prosecuting a CT case and has a handful of phon es 


b6 

b7C 

b7E 

b7A 


] Can either of your respective units assist with guiding them on handling/searching the 


evidence as safely as possible, or if not, refer me to the appropriate place who might? 


Many thanks in advance. 


Classification : 


b6 

b7C 


Classification: UNCLASS I FIED// F i OUO 


Classification: UNCLASSIFIED//^:WO 


2 







Classification: UNCLASSIFIED//eew 



b7E 


Examples of existing projects that analyze latent evidence 


I 

I 

I 


This is a great time to have this discussion. Every version of every app encoun tered in a mobile device requires a 

T iave been developing training curriculum 

(ahem, I mean, presentations and one-on-one interactions), to familiarize computer scientists! 
and we think it is now time to get everyone working together. 


Worki ng! [ initially, we've begun to 

Our goal is to get as many players to agree on a common definition that we can all use! 




I hope this helps to explain our point of view regarding differentiation between our respective missions and mobile data. 
I'd be happy to talk more, just let me know when you'd like to get together! 


1 


b6 

b7C 




Subject: RE: Kik App — UNCLASSIFIED//E©y0 


b6 

b7C 

b7E 


Classification : 


UNCLASSIFIED// 






Subject: RE: Kik App — UNCLASSIFIED//F©y©. 


Classification: UNCLASSIFIED/ /TWO 



What are the makes/models of the devices? 


Thanks, 


can provide further guidance (CC'dj. 


b6 

b7C 

b7E 




b6 

b7C 

b7E 


From! 


Ifbi) 


Sent: Wednesday, November 26, 2014 5:14 PM 


To 1 IfFBDl 

k 

Cc;^ f?FBi); 

f(FBi) 

Subject: Kik App — UNCLASSIFIED//f=©tter 



Kfbi) 


Classification: UNCLASSIl 


Gentlemen, 


I I Squad, out of the | ~| Division is in t he middle of prosecuting a CT case and has a handful of phone s 

in their possession pursuant to a search. They are aware 

I _ I 

I I Can either of your respective units assist with guiding them on handling/searching the 

evidence as safely as possible, or if not, refer me to the appropriate place who might? 


b6 

b7C 

b7E 

b7A 


Many thanks in advance. 


b6 

■===================================================== 

Classification: UNCLASS I FIED/ ; ^ OUO 


Classification: UNCLASSIFIED/ /FOUO 


Classification: UNCLASSIFIED// FOUO 


Classification: UNCLASSIFIED/ / TOUQ 


3 







£1!! 



1 




From: | 


Kfbi) 




Sent: 

Tuesday. December 02. 2014 5:11 PM 




To: 

1 

|(FBI):I 


mFBI)l 



(OGA) 





Cc: 


1 (FBIll 


IfFBlii 



tFBDi 


_|(FBI) 


(FBI) 


Subject: RE: Kik App — UNCLASSlFIED/j'FSB^ 


Classification: UNCLASSIFIED/ /FOUO 


Hev I I 

I think it would be worthwhile to possibly have a S VCT where we can discuss with you what we have conducted and 
what we believe we are missing. We have had th^ ~|but the issue is that known 

Kik materials are I 

|on the phone as well. 

Please let me know when you might be available as we would greatly appreciate the opportunity to get your advice on 
howto proceed. 

Thanks 


From£ 

Sent: 


J(FBI) 


TO 


I(FBI) 



(FBI); 

l(FBI)l 

l(FBI); 




1 (FBI);! 


1 (FBI) 




Subject: RE: Kik App — UNCLASSIFIED//I=©ye 


Classification: UNCLASS I FIFO/ /- f ^ QUO - 


Please let me kn ow when you would like to dis cuss this case. We have historically been able to|~ 
Apps are consistently updated! 


A couple of suggestions and questions: 


1 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 












Se nt: Wednesday, November 26, 20 14 5: 14 PM 

To - 1 rFBlH ~l (FBI) b6 

cc J I rFBn: l 1 m) hic 

Subject: Kik App — UNCLASSIFIED//F6W© b7E 


Classification: UNCLASS I FIED//?©t?0 


Gentlemen, 


[ 


jSquad, out of th d I Division is in the middle of prosecuting a CT case and has a handful of phones 


c 


in their possession pursuant to a search. They are aware [ 


[ 


] Can either of your respective units assist with guiding them on handling/searching the 


b6 

b7C 

b7E 

b7A 


evidence as safely as possible, or if not, refer me to the appropriate place who might? 


Many thanks in advance. 


Classification : 


Classification: UNCLASSIFIED//-F^0TO 


Classification: UNCLASSIFIED//-P0«e^ 


Classification: UNCLASSIFIED// FOUO 


b6 

b7C 


3 








1(FB!) 


From: 

Sent: 

To: 


[ 


]{FBI) 


Wednesday, December 03, ?014 9:17 AM 

I I (FBI): I 


](FBI);C 


Cc: 1 

f 1 (fbhI 


lfFBI);l 


[ — wm 

_J (FBI)| 


|(FBI) 

Subject: 

RE: Kik App — UNCLASSIFIED/m©ee 





Classification: UNCLASSIFIED/ /FOUO 


[ 


Let me know w hen you are avai lable and a couple of our folks will do our best to get together to hear what is going on 

as well. If you can provide any information | 

it will help us understand what we are dealing with. 


We are familiar 


Feel free to give me a call at my desk or mobile to setup a time. 



Please Visit oun 


From J (FBI) 

Se nt: Tuesday, December 02 , 2014 5:11 PM 
To: | If FBH: [ 

Cc: 


[ 


](FBi)E 


1 (FBI); 


Subject: RE: Kik App — UNCLASSIFIED//F©ye 


](FBir 


]KFBI)£ 

_iFBI);[ 


] (OGA) 


1)(FBI);1 


Classification: UNCLASSIFIED/ 


Hev i I 

I think it would be worthwhile to possibly have a SVCT where we can discuss with you what we have conducted and 
what we believe we are missing. We have had the| | but the issue is that known 

Kik materials are| 

on the phone as well. 

Please let me know when you might be available as we would greatly appreciate the opportunity to get your advice on 

how to proceed. 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


1 





2 






From: 


I (FBI) 


Se nt: Monday, December 01, 2014 1:59 PM 

Tof 
Cc[ 




IFBI);L 


1(FBI) 

n(FBi);[ 


](FBI) 


](FBI);[ 


Subject: RE: Kik App — UNCLASSIFIED//FeH©- 


] (FBI); 


b6 

b7C 

b7E 


Classification: UNCLASSIFIED/;"-Pe¥^ 


Hi 


The best strategy will likely be tc£ 


What are the makes/models of the devices? 


b6 

b7C 

b7E 


can provide further guidance (CCd). 


Thanks, 


b6 

b7C 

b7E 


From: 


(FBI) 


Sent: Wednesday, November 26, 2014 5:14 PM 
To i ~l (FBI) i 

Cc J I (FBi) j 

Subject: Kik App — UNCLASSIFIED//feye 


] (FBI) 


] (FBI) 


b6 

b7C 

b7E 


Classification: UNCLASSIFIED/ 


Gentlemen, 


[ 


Jsquad, out of th d 1 Division is in t he middle of prosecuting a CT case and has a handful of phone s 


c 


in their possession pursuant to a search. They are aware 


b6 

b7C 

b7E 

b7A 


[ 


Can either of your respective units assist with guiding them on handling/searching the 


evidence as safely as possible, or if not, refer me to the appropriate place who might? 


Many thanks in advance. 


3 


b6 

b7C 



Classification: UNCLASSIFIED/ /-¥ 0 \^ 


Classification : 


Classification: UNCLASSIl 


Classification: UNCLASSIl 


Classification : 


4 



m. 


b6 

—I— b7C 


From: 

Sent: 

To: 

Subject: 


I K FBI) 

Wednesday. December 03. 2014 1 2:38 PM 
I i FBI) 

RE: Kik App — UNCLASSIFIED//F0ye- 


b7E 


Classification: UNCLASSIFIED//^‘©TO- 


We've already had this discussion numerous times. In fact, you attended the original m eeting a t which these missions 
were defined. Since then, every meeting to re-ctarify the missions has been triggered bv l I steppinR beyond the 
missions agreed to previously. And since then, every follow on meeting has served only to re-iterate and re-establish 
what had been previously determined. 


b6 

b7C 

b7E 


It is true tha t many entities touch or are to uched by mobile devices, however when it comes tcC 
the missions T 


could not be more simple than what has been initially agreed to and 


b7E 


subsequently reaffirmed: 


Your email su^ggests thatL 


1 

and that simply does not square with any previous 


understandings between our units. I don't understand why this remains a point of confusion. 


Mobile devices are literally nothing more than hand-held computers. They run on operating sytems that are less familiar 
than traditional computers, but there should be no illusions -they are computers. ! 

~| In the end, though, they are 

just computers and they should be treated no differently than we treat any computer. 

| lt can't be much 

more simple than that, and making it more complicated is not helpful. Frankly, it's frustrating. 

If this is not clear, then by all means let's have this discussion yet another time. We will continue to do so until these 
logical and previously agreed upon missions are clear to all. 

Please give me a call at your convenience so we can discuss if necessary. 


b6 

b7C 


From: 


(FBI) 


b6 

b7C 

b7E 


1 



Subject: FW: Kik App — UNCLASSI 


Classification: UNCLASSI 



Examples of existing projects that analyze latent evidence 



This is a great time to have this discussion. Every version of every app encountered in a mobile device requires a 

Ihave been developing training curriculum 


(ahem, I mean, presentations and one-on-one interactions), to familiarize computer scientist; 



I and \we think it is now time to get everyone working together. 

nitially, we've begun to| 

Our goal is to get as many players to agree on a common definition that we can all us 




Workin 

1 

■ 


Back to Ki 










If we are able to agree to a common T [ definition 
benefit all LE partners. Forexample.l 


b7E 


all players could benefit from them. 

I hope this helps to explain our point of view regarding differentiation between our respective missions and mobile data. 
I'd be happy to talk more, just let me know when you'd like to get together! 


b6 

b7C 


From j I (FBI) 

Se nt: Monday, December 01, 2 014 5:16 PM 
Toj nCF BI) 

Cc J ~n (FBI) 

Subject: RE: Kik App — UNCLASSIFIED//Fette 


b6 

b7C 

b7E 


Classification: UNCLASSIl 


Hev^ 


Based on the meeting that took place last year, it is my understanding that this analysi^ 


b6 

b7C 

b7E 


Please see 


attached email wherel 


[summarized these conclusions. It appears from your email below, that] 
Thoughts? 


« Message: RE 


BVTC — UNCLASSIFIED//feye-» 


From! 

“□(FBI) 



b6 

Sent: Monday, December 01, 2014 1:59 PM 



b7C 

To| 

(FBI) ^ 



b7E 

Cc:l 

(FBI); 

l(FBI); 

(FBI)I 



I | FBI); | I (FBI) 

Subject: RE: Kik App — UNCLASSIFIED/ /rOU 0- 


Classification: UNCLASSIFIED/ 


H j I 

The best strategy will likely be to 


b6 

b7C 

b7E 


What are the makes/models of the devices? 


3 




can provide further guidance (CC'd). 



Fromj |(FBI) 

Se nt: Wednesday. November 26. 20 14 5:14 PM 

To | l(FBI);|ZZ 

C d K FBD l 

Subject: Kik App — UNCLASSIFIED/ /FOUO 


Classification: UNCLASSIFIED/, 


Gentlemen, 


I Sauad. out ofth d I Pivision is in t he middle of prosecuting a CT case and has a handful of phones 

in their possession pursuant to a search. They are awarel 


Can either of your respective units assist with guiding them on handling/searching the 
evidence as safely as possible, or if not, refer me to the appropriate place who might? 


Many thanks in advance. 


Classification: UNCLASSII 


Classification : 


Classification: UNCLASSII 


Classification: UNCLASSII 


Classification : 


Classification: UNCLASSIFIED//fW6i 


4 



